Phishing tests that teach, not trap
Phishing simulations that shame people make them hide mistakes. Run them to practise reporting, not to catch people out.
Many companies run phishing simulations in October. Done badly, they send a trick email, count who clicked, and enrol those people in a boring course. Staff learn one lesson: if you click something, don’t tell anyone.
That’s the opposite of what you need. In a real attack, the fastest report is worth more than the click rate.
How I’d run them:
- Measure reports, not just clicks. The goal is a higher report rate and a faster first report.
- Use realistic lures from this year: shared document, MFA reset call follow-up, delivery notice, invoice change.
- When someone clicks, show a short, friendly page explaining the signs. No public lists, no punishment.
- Don’t use cruel lures, like fake bonuses or layoffs. They destroy trust.
- Share overall results with everyone, and celebrate the people who reported first.